Title
#general
n

nebi

02/20/2019, 9:12 PM
Hi guys in my machine when I query
process_namespaces
like this
select * from process_namespaces
some of the processes do not have
pid_namespaces
even
pid1
does not have pid_namespace. Is this normal?
8p8c

8p8c

02/20/2019, 9:36 PM
osquery> select version from osquery_info ;
version = 3.3.2
osquery> select * from process_namespaces limit 1 ;
             pid = 1
cgroup_namespace = 4026531835
   ipc_namespace = 4026531839
   mnt_namespace = 4026531840
   net_namespace = 4026531957
   pid_namespace = 4026531836
  user_namespace = 4026531837
   uts_namespace = 4026531838
9:38 PM
works for me. without more specifics from you i couldn't tell what's wrong with your install.
n

nebi

02/20/2019, 9:45 PM
is this ubuntu machine?
8p8c

8p8c

02/20/2019, 9:45 PM
yes
n

nebi

02/20/2019, 9:45 PM
My version is 3.3.2 and my machine is ubuntu 18.04
8p8c

8p8c

02/20/2019, 9:46 PM
my output above is from 16.04
n

nebi

02/20/2019, 9:46 PM
hmm
9:46 PM
you think that's the problem?
8p8c

8p8c

02/20/2019, 9:47 PM
i haven't tried but i doubt. getting namespaces shouldn't have changed so dramatically between the kernels
9:50 PM
but feel welcome to prove me wrong.
9:51 PM
more information on the details how you're getting your results would also be useful.
n

nebi

02/20/2019, 9:56 PM
@8p8c can you be more specific
9:56 PM
im just running
osqueryi
8p8c

8p8c

02/20/2019, 9:57 PM
how?
n

nebi

02/20/2019, 9:57 PM
then this command
select *  from process_namespaces
8p8c

8p8c

02/20/2019, 9:59 PM
k. so, tried it with sudo also?
n

nebi

02/20/2019, 10:00 PM
you mean when I type
osqueryi
?
8p8c

8p8c

02/20/2019, 10:03 PM
Yes. How else are you going to get data out accessible only to root?
n

nebi

02/20/2019, 10:06 PM
omg, it worked now!
10:06 PM
thanks man
10:06 PM
sorry, I'm just beginner
8p8c

8p8c

02/20/2019, 10:08 PM
Np. Don’t forget to close the issue in github.
n

nebi

02/20/2019, 10:13 PM
done
10:13 PM
thanks